Privacy Policy

GOODTRACK PRIVACY POLICY

This Privacy Policy (“Policy”) is made available and maintained by GOODTRACK TECNOLOGIA LTDA, a private legal entity, duly registered under CNPJ No. 57.516.477/0001-41.

At GOODTRACK, privacy and security are priorities, and we are committed to transparency in the processing of personal data of our Users and of third parties. This Privacy Policy establishes how information is collected, used, and transferred from Users who use the Goodtrack Platform, as well as third-party data collected by them and added to the Platform.

CONCEPTS AND DEFINITIONS

• PERSONAL DATA: Any information related to an identified or identifiable natural person;
• SENSITIVE DATA: personal data about racial or ethnic origin, religious belief, political opinion, membership in a trade union or in an organization of a religious, philosophical, or political nature, data concerning health or sex life, genetic or biometric data, when linked to a natural person;
• ANONYMIZATION: Use of reasonable technical means available at the time of Processing so that Personal Data can no longer be associated, directly or indirectly, with an individual;
• SHARED USE OF DATA: communication, dissemination, international transfer, interconnection of personal data, or shared processing of personal databases by public bodies and entities in the performance of their legal duties, or between them and private entities, reciprocally, with specific authorization, for one or more processing activities permitted by those public entities, or between private entities;
• DATABASE: Structured set of personal data, established in one or several locations, on electronic or physical media.
• LEGAL BASIS: Grounds provided in articles 7 and 11 of the LGPD that authorize GOODTRACK to Process the Personal Data of Data Subjects;
• CONSENT: Free, informed, and unambiguous manifestation by which the Data Subject agrees to the Processing of their Personal Data for a specified purpose;
• CONTROLLER: The natural or legal person, governed by public or private law, who is responsible for decisions regarding the Processing of Personal Data;
• COOKIES: Cookies are a technology that can be used to help personalize the use of a website. A cookie is a small amount of data that generally includes a unique identifier that is sent to your device from the website and is stored in the browser or hard drive of your device;
• DATA PROTECTION OFFICER: person appointed by GOODTRACK, responsible for ensuring that the rights of Data Subjects are met and for clarifying questions about the Processing of their Personal Data, and who may also be known as Data Protection Office - DPO;
• PURPOSE: the reason Personal Data will be Processed, or the objective intended to be achieved with the Processing of the Data;
• LGPD: This is the Brazilian General Data Protection Law (Law No. 13.709/2018);
• ANDP: Autoridade Nacional de Proteção de Dados, a body of the public administration responsible for safeguarding, implementing, and overseeing compliance with the General Data Protection Law throughout the national territory.
• PROCESSOR: The natural or legal person, governed by public or private law, who carries out the Processing of Personal Data on behalf of the Controller;
• CONTROLLER: natural or legal person, governed by public or private law, who is responsible for decisions regarding the processing of personal data
• THIRD PARTY: Refers to, but is not limited to, any natural or legal person whose data GOODTRACK may access directly or indirectly, within the scope of the GOODTRACK software, such as suppliers, customers of our customers, employees, or representatives of our customers;
• DATA SUBJECT: Natural person to whom the Personal Data relate, such as customers and users;
• PROCESSING: Any operation, or set of operations, carried out with Personal Data.

1. DATA COLLECTED AND METHOD OF COLLECTION

1.1. As a data Controller, Goodtrack may collect personal data necessary for the provision of its respective services, intended for the creation and management of the account, including, but not limited to, name, email address, contact information, and document number. Collection occurs through registration on the platform and interactions with our services, and may also occur through cookies and similar technologies, or, further, by authorization specifically collected in another way.

1.2. For users who choose to subscribe to paid plans, the required data related to billing (credit card data and billing address) are not stored by GOODTRACK.

1.3. The Platform stores metrics data that are vital for the analysis and optimization of the performance of the campaigns of its respective Users. This includes, but is not limited to, data and spending on ads in Ad Manager Platforms, as well as sales made on sales platforms where data sharing is carried out by the User.

1.4. By virtue of its activity, GOODTRACK acts as a Data Processor with respect to Third-Party Data collected by the User (through other platforms, such as Meta and/or Google), such data being communicated to the Goodtrack Platform automatically by the webhook systems and system APIs linked by the User themselves. This means that GOODTRACK will process such Personal Data on behalf and by order of the User, that is, the holder of the account at GOODTRACK, who will in this case be the Data Controller, responsible for such processing operations. Accordingly, it is the User's responsibility, in accordance with Law No. 13.709/18, to set the objectives that justify the Processing, its respective legal basis, and to obtain applicable authorizations, and it is also the User's responsibility to respond to requests from Personal Data Subjects.

1.5. With attention to the security and privacy of data, GOODTRACK does not collect, receive, or keep sensitive data of Users or of third parties. If such data are inadvertently received from third-party platforms, they are immediately deleted as soon as they are identified, ensuring that they are not stored or shared with third parties.

1.6. To improve and optimize its advertising campaigns, GOODTRACK collects data from ads delivered to ad managers linked to and/or integrated with the Platform by the User, allowing GOODTRACK to access the relevant metrics of their respective campaigns.

1.7. GOODTRACK is not responsible for the accuracy, truthfulness, or lack thereof in the information that the User or a platform linked by the User enters on the GOODTRACK Platform, or for it being out of date. It is the responsibility of the User or of the third-party platform to provide it accurately or to update it.

1.8. When a sale is made and communicated to GOODTRACK by means of a webhook from partner sales platforms, we receive a series of data about the end customer. This includes CPF/CNPJ, email, telephone, IP, date of birth, and address. Of this information, only the end customer's email is stored in our database. The other information may be used for resending to Facebook, with the objective of optimizing advertising campaigns, according to the usage preferences of our platform.

1.9. GOODTRACK undertakes to use the data collected exclusively for the specified purposes, respecting the privacy and security of the information of Users and of Third Parties. The platform complies with current data protection legislation, ensuring that users have control over their personal information and can exercise their rights of access, rectification, and deletion as necessary.

1.10. As required by art. 15 of the Brazilian Civil Rights Framework for the Internet (Law No. 12.965/14), GOODTRACK keeps all logs of the User's actions for a minimum period of 6 (six) months, and they are automatically deleted after the indicated period, except by legal obligation, court request, or indication of or need to preserve evidence in investigations of unlawful activities, suspected fraud, violations of terms or usage policies, or to protect the rights and security of GOODTRACK, of its users, or of third parties.

1.11. To link these actions to a specific user, a unique identifier (ID) is created at the time of user registration. That ID is then associated with all activities recorded in the logs, allowing a direct correlation between the actions and the user responsible for them. The types of logs recorded include: application errors, which help us identify and correct failures; and activity data, such as changes to campaigns, deactivations, and changes to settings, as well as sales data. These records are classified as temporary and kept for a security period, being automatically deleted in due time.

2. USER RIGHTS

2.1. As provided in art. 18 of the General Data Protection Law (LGPD), natural persons, as subjects of personal data, have the right to (a) confirmation of the existence of processing of their personal data; (b) access to their respective data; (c) request and receive the correction of incomplete, inaccurate, or outdated data; (d) anonymization, blocking, or deletion of unnecessary or excessive data or data processed in noncompliance with this Law; (d) portability of the data to another service or product provider, upon express request, in accordance with the regulation of the national authority, observing commercial and industrial secrets; (e) deletion of personal data processed with the consent of the data subject, except in the cases provided in art. 16 of the General Data Protection Law; (f) information about the public and private entities with which the controller carried out shared use of data; (g) information about the possibility of not providing consent and about the consequences of refusal; (h) revocation of consent given for the processing of data, under the terms of § 5 of art. 8 of the General Data Protection Law; (i) petition regarding their data against the controller before the national data protection authority; (j) object to processing carried out on the basis of one of the cases of waiver of consent, in the event of noncompliance with the General Data Protection Law; (k) exercise their rights by means of an express request by the data subject or by a legally constituted representative, to the processing agent, being served at no cost, within the time limits and under the terms provided in regulation.

2.2. If the Data Subject seeks to exercise any of their rights before GOODTRACK, they must communicate it, through the Data Protection Officer, as set out in this Privacy Policy, regarding their request.

2.3. GOODTRACK undertakes to respond, within 2 (two) business days, to the Data Subject regarding their request, fulfilling the request whenever possible immediately, or informing the time limit for fulfilling the request.

3. FORM AND PERIOD OF DATA STORAGE

3.1. Except under the conditions expressly established, GOODTRACK, acting as Controller of the data, ensures that the data collected through the Goodtrack Platform will be removed automatically after their use for the purposes identified in this Privacy Policy.

3.2. Users must be aware that the removal of data indispensable for the administration of their accounts on the Goodtrack Platform will result in the deactivation of their registration and the consequent interruption of the services provided by the platform.

3.3. In situations where the account is closed, resulting from termination of the Terms of Use of the Goodtrack Platform, GOODTRACK undertakes to delete from its Database the Data associated with the closed account, as well as any Data provided by the customer on the Platform. This will occur after a period of 60 days counted from the end of the contract. However, we will retain only those data that are indispensable to fulfill GOODTRACK's legal obligations, comply with regulations, resolve disagreements with the User, prevent fraud or misuse of the Platform and of the Data, and ensure adherence to the provisions of this Privacy Policy and of the Terms of Use of the Goodtrack Platform.

4. DATA SECURITY AND SHARING

4.1. All data processed by GOODTRACK are protected by the implementation of standard security and encryption protocols, on its own servers or servers contracted by it. These measures form the basis of the security approach, aiming to protect the integrity and confidentiality of the information of Users and of Third Parties.

4.2. GOODTRACK undertakes to implement advanced technological measures that meet the legal requirements for the protection of the privacy of the data stored on its Platform. This includes: (a) robust security mechanisms to prevent unauthorized access to its systems; (b) strict management of access to the information collected, ensured by the strict adherence of employees and external collaborators to confidentiality terms, with actions guided by the principles of proportionality, necessity, and relevance, always with the aim of safeguarding privacy as established in this Policy; (c) periodic and continuous training of its collaborators, intended to identify, assess, and mitigate risks related to data privacy and the best practices of data protection and privacy.

4.3. GOODTRACK will operate with shared use of data, and may share or receive data: (a) with social network platforms and advertising services, for optimization of advertising campaigns and improvement of ad targeting; (b) with suppliers and service partners that offer technological and operational solutions necessary for the performance and continuous improvement of the services offered by the platform; (c) in response to legal or regulatory obligations, when it is necessary to share data with government authorities or other regulatory entities; (e) during external audits and compliance processes to ensure and demonstrate adherence to regulatory requirements and industry standards, ensuring that the auditing company meets the legal requirements of data compliance; and (f) with other entities, when there is a need to collaborate with investigations to prevent fraud or illegal activities, ensuring the integrity and security of both the platform and the data of its users.

4.4. GOODTRACK will not share the User's Data with third parties without the User's consent, except: (a) as necessary to meet the User's instructions and requests; (b) to the extent necessary to enable the functionality of the contracted GOODTRACK services; (c) to comply with court orders under the legislation in force, or in judicial proceedings to establish or exercise its legal rights or undertake a defense against lawsuits; (d) when it believes in good faith that it is necessary to share the Information in order to investigate, prevent, or take measures relating to illegal activities, suspected fraud, situations involving possible threats to the physical safety of any person, or violations of the Terms and Conditions of Use of GOODTRACK; (e) in the event of sale of GOODTRACK's assets, as a result of a change in its control, in events related to corporate changes, or in preparation for any of those events (and the acquirers will have the right to continue to use the Information in accordance with this Privacy Policy); (f) for other purposes, through procedures specified and authorized by law or by the User.

4.5. GOODTRACK reserves the right to share the information it collects with the service providers that assist it in its operations, including entities in charge of data processing (processors), cloud computing service providers, information technology consultants, telecommunications providers, delivery agents, advertising and marketing agencies, event organizers, and companies involved in the management of financial credits.

4.6. The User and Third Parties may, at any time, make a communication to the Autoridade Nacional de Proteção de Dados – ANDP, in the event of security incidents that may cause relevant risk or damage.

5. COOKIE POLICY AND BROWSING DATA

5.1. We use the information collected automatically and other information collected on the Service by means of cookies and similar technologies to: (i) personalize our Service, such as remembering a User's or Visitor's information, so that the User or Visitor does not need to enter it again during a visit or on subsequent visits; (ii) provide personalized ads, content, and information; (iii) monitor and analyze the effectiveness of Service activities and of third-party marketing; (iv) monitor aggregate website usage metrics, such as the total number of visitors and pages viewed; and (v) track your entries, submissions, and status in any promotions or other activities on the Service. You can obtain more information about cookies by visiting our Cookie Policy.

6. CHANGES TO THE PRIVACY POLICY

6.1. This Privacy Policy is the one in force to govern the services made available by the Goodtrack platform since 08/05/2024.

6.2. GOODTRACK reserves the right to modify this Privacy Policy at any time, at its sole discretion, provided that the need and/or convenience of the company is identified for adaptation to the legislation in force, in particular the General Data Protection Law, and to the regulatory rules of the Autoridade Nacional de Proteção de Dados – ANDP.

6.3. GOODTRACK will inform Users of future changes to the Privacy Policy by uploading it on the access platform, acceptance of which will be an indispensable condition for continuing to use the contracted service, as well as by means of a notice by email, to the email registered by the User on the platform. Use of the Goodtrack Platform by the User will constitute the User's full acceptance of the new Privacy Policy.

7. PRIVACY OF MINORS

7.1. Preserving children's privacy is of the utmost importance to GOODTRACK. Our Service is not designed for individuals under 18 years of age, and we do not purposefully collect personal information from minors without the consent of their parents or legal guardians.

7.2. We ask that persons under 18 years of age not use or access the Service under any circumstance. If GOODTRACK is notified or detects personal data collected from a person under 18 years of age without due authorization, it will take measures to delete such information from the records.

7.3. If you are a father, mother, or legal guardian and notice that a minor has obtained access and created an account at GOODTRACK, contact us immediately through the email admgoodtrack@gmail.com.com.br so that we can delete the minor's personal information from our systems.

8. DATA PROTECTION OFFICER

8.1. The person responsible for the processing of personal data, as established in this Privacy Policy, is Mr. Bruno Fernandes dos Santos. To clarify doubts, make inquiries, or submit requests related to this Policy or to the processing of data, he may be contacted through the email admgoodtrack@gmail.com.com.br.

9. APPLICABLE LEGISLATION

9.1. This Privacy Policy shall be interpreted in accordance with the laws in force in the Federative Republic of Brazil, being governed specifically by the Brazilian Civil Rights Framework for the Internet (Law No. 12.965/14), as well as by the General Data Protection Law (Law No. 13.709/18).

10. GOOGLE USER DATA

This section was added on 09/10/2026. If you connect Google Ads to Goodtrack, you authorize that connection on Google's consent screen. Goodtrack then accesses Google user data from the Google Ads account you authorize. This section describes that data. For Google user data received through that connection, this section controls.

10.1. Google user data Goodtrack accesses

With your authorization, Goodtrack accesses:

• the OAuth access token and refresh token Google issues for your Google Ads account, so Goodtrack can keep reading that account;
• Google Ads account identifiers, account names, currency, and account status, including client accounts under a manager account you can access;
• campaign, ad group, and ad identifiers and names, and their status;
• delivery metrics for those accounts, campaigns, ad groups, and ads: spend, impressions, and clicks.

Goodtrack requests this information from the Google Ads API when you open the dashboard. Goodtrack does not receive your Google password. It does not access Gmail, Google Drive, or other Google products outside the Google Ads account you authorize.

10.2. How Goodtrack uses this data

Goodtrack uses this Google user data to show your Google Ads accounts, campaigns, ad groups, ads, and delivery metrics in your Goodtrack dashboard, alongside the sales Goodtrack already tracks for you. Goodtrack stores the account identifiers you choose so the dashboard knows which Google Ads accounts to include. Goodtrack stores the access token and refresh token so it can request updated metrics until you disconnect.

Goodtrack does not sell this Google user data. Goodtrack does not use it to run ads, to serve advertising, or to retarget you or anyone else. Goodtrack does not use it to train generalized artificial intelligence or machine learning models.

10.3. With whom this data is shared

Goodtrack does not sell Google user data and does not share it with data brokers, advertising networks, or other Goodtrack customers. It is available only in the Goodtrack account that connected Google Ads. Goodtrack uses the token only to request this data from Google. It does not pass the token or the Google Ads data to any other company for that company's own use. The data is stored on Goodtrack's systems. If those systems are hosted by a provider contracted by Goodtrack, that provider processes the data only to operate the service.

10.4. How this data is protected

You grant access on Google's consent screen. Goodtrack does not ask for or store your Google password. The tokens are stored with your Goodtrack integration record and are used only to call the Google Ads API for your account. Those calls use HTTPS. Goodtrack's Google Ads endpoints require your authenticated Goodtrack session.

10.5. How long this data is kept and how you can delete it

Goodtrack keeps the Google Ads access token and refresh token until you disconnect Google Ads. Disconnecting Google Ads in Goodtrack deletes those tokens from Goodtrack. After that, Goodtrack can no longer request Google Ads data for that connection. You can also remove Goodtrack's access in your Google Account; Goodtrack will then be unable to refresh the connection. To delete the tokens Goodtrack has stored, disconnect Google Ads in Goodtrack. Campaign names and delivery metrics are requested from Google when you view the dashboard and are not stored by Goodtrack as a separate copy of your Google Ads account. The Google Ads account identifiers you selected for the dashboard stay in your Goodtrack settings until you change that selection.